From e6b39a1d97c2b48ce3be9a5046826a4067e2d188 Mon Sep 17 00:00:00 2001 From: "alexandru.dimofte" Date: Wed, 1 Jul 2026 09:06:25 +0100 Subject: [PATCH 1/9] ci: Enable Semgrep and Zizmor scans --- .github/workflows/semgrep.yml | 38 ++++++++++++++++++++++ .github/workflows/zizmor.yml | 61 +++++++++++++++++++++++++++++++++++ 2 files changed, 99 insertions(+) create mode 100644 .github/workflows/semgrep.yml create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 00000000..649bfadc --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,38 @@ +# SPDX-FileCopyrightText: (C) 2026 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 +--- + +name: Semgrep Scan + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read +jobs: + semgrep: + permissions: + contents: read + runs-on: ubuntu-latest + container: + image: returntocorp/semgrep@sha256:14e073f6417e5d2d0797aa13f26d569270b86fac9d52052d2358c985f1a4e9f0 # v1.124.0 + steps: + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + + - name: Checkout code + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - name: Run Semgrep scan + uses: open-edge-platform/orch-ci/.github/actions/security/semgrep@8e869384de7ed5f98941c59c2e4ac73eb09862fb # 2026.1.3 + with: + scan-scope: all + severity: "HIGH" + output-format: "text" diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..01c3587d --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,61 @@ +# SPDX-FileCopyrightText: (C) 2026 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 +--- + +name: Zizmor Scan + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + zizmor: + permissions: + contents: read + security-events: write + + runs-on: ubuntu-latest + + env: + ZIZMOR_VERSION: 1.20.0 + + steps: + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + + - name: Checkout code + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Install uv + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + with: + enable-cache: false + + - name: Run Zizmor + run: | + uvx zizmor=="$ZIZMOR_VERSION" \ + --format sarif \ + .github \ + > zizmor_scan_report.sarif + + - name: Upload SARIF to GitHub Security + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + sarif_file: zizmor_scan_report.sarif + + - name: Upload Zizmor report artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: zizmor-results + path: zizmor_scan_report.sarif + retention-days: 7 From 310b5e52badb4f422e6c9031c1b970329071b917 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:04:31 +0300 Subject: [PATCH 2/9] ci: Delete .github/workflows/semgrep.yml --- .github/workflows/semgrep.yml | 38 ----------------------------------- 1 file changed, 38 deletions(-) delete mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml deleted file mode 100644 index 649bfadc..00000000 --- a/.github/workflows/semgrep.yml +++ /dev/null @@ -1,38 +0,0 @@ -# SPDX-FileCopyrightText: (C) 2026 Intel Corporation -# SPDX-License-Identifier: Apache-2.0 ---- - -name: Semgrep Scan - -on: - push: - branches: [main] - pull_request: - branches: [main] - workflow_dispatch: - -permissions: - contents: read -jobs: - semgrep: - permissions: - contents: read - runs-on: ubuntu-latest - container: - image: returntocorp/semgrep@sha256:14e073f6417e5d2d0797aa13f26d569270b86fac9d52052d2358c985f1a4e9f0 # v1.124.0 - steps: - - name: Harden Runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 - with: - egress-policy: audit - - - name: Checkout code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - name: Run Semgrep scan - uses: open-edge-platform/orch-ci/.github/actions/security/semgrep@8e869384de7ed5f98941c59c2e4ac73eb09862fb # 2026.1.3 - with: - scan-scope: all - severity: "HIGH" - output-format: "text" From f6af0852f8ae8f2c32a0736946c5368b06a6af15 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:39:32 +0300 Subject: [PATCH 3/9] ci: Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/zizmor.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 01c3587d..b6609278 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -32,8 +32,7 @@ jobs: egress-policy: audit - name: Checkout code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 persist-credentials: false - name: Install uv From d6a04b5bff61679c50b1e1a2e8343e51f0182330 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:39:51 +0300 Subject: [PATCH 4/9] ci: Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index b6609278..c5a73d0c 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit From a84a4c5d0d7109e506ddef2287d16b605b659243 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:40:30 +0300 Subject: [PATCH 5/9] ci: Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index c5a73d0c..843cd33d 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -48,10 +48,10 @@ jobs: > zizmor_scan_report.sarif - name: Upload SARIF to GitHub Security + if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }} uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: zizmor_scan_report.sarif - - name: Upload Zizmor report artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: From ef587c3907cfa53d9d793cd9316ae3e4b25d0100 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:42:01 +0300 Subject: [PATCH 6/9] ci: Update zizmor.yml --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 843cd33d..e585f491 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -48,7 +48,7 @@ jobs: > zizmor_scan_report.sarif - name: Upload SARIF to GitHub Security - if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }} + if: always() uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: zizmor_scan_report.sarif From 0d8c39ab09f73dc2e1b8db1fc41c309c9af73847 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:51:35 +0300 Subject: [PATCH 7/9] ci: Update zizmor.yml --- .github/workflows/zizmor.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index e585f491..a602daf6 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -30,23 +30,19 @@ jobs: uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - - name: Checkout code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 persist-credentials: false - - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: enable-cache: false - - name: Run Zizmor run: | uvx zizmor=="$ZIZMOR_VERSION" \ --format sarif \ .github \ > zizmor_scan_report.sarif - - name: Upload SARIF to GitHub Security if: always() uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 From 578413c2c9683f1781a9310cb63808dd601acad2 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 09:58:23 +0300 Subject: [PATCH 8/9] ci: Update zizmor.yml --- .github/workflows/zizmor.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index a602daf6..33d1472b 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -32,6 +32,7 @@ jobs: egress-policy: audit - name: Checkout code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: persist-credentials: false - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 From 5045e0d7d4c7567370537f232e73f5535c11bcb4 Mon Sep 17 00:00:00 2001 From: Alexandru Dimofte Date: Thu, 9 Jul 2026 10:22:05 +0300 Subject: [PATCH 9/9] ci: Update zizmor.yml --- .github/workflows/zizmor.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 33d1472b..4a620bbb 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -1,7 +1,6 @@ # SPDX-FileCopyrightText: (C) 2026 Intel Corporation # SPDX-License-Identifier: Apache-2.0 --- - name: Zizmor Scan on: